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Abstract 

The general principle for a quantum signature scheme is proposed and investigated based on ideas 
from classical signature schemes and quantum cryptography. The suggested algorithm is implemented 
by a symmetrical quantum key cryptosystem and Greenberger-Horne-Zeilinger (GHZ) triplet states 
and relies on the availability of an arbitrator. We can guarantee the unconditional security of the 
algorithm, mostly due to the correlation of the GHZ triplet states and the use of quantum one-time 
pads. 
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1 Introduction 



Quantum cryptography combines quantum theory with classical cryptography. The main goal of this field 
is to take advantage of purely quantum effects to provide unconditionally secure information exchange 
[1], in contrast in general to classical methods. Those are mostly very secure due to the complexity of 
the system employed, however become increasingly vulnerable with more powerful computers and thus 
improved means of handling complexity. Many advances have been put forward in quantum cryptography 
in recent years, including enhanced insights in the basic theory [2], quantum key management [3,4], 
quantum secret sharing [5] , quantum authentication [6] and quantum bit commitment [7] . In particular, 
quantum key distributions attracted special interest due to technological advances which allow their 
implementations in laboratory, and theoretical investigations, which proofed them to be unconditionally 
secure [4]. 

An important issue in cryptography is the reliable assignment of a message to its originator. Equally 
a certification appears often useful that a particular person has noted or agreed to a message composed 
by someone else. Signature schemes are developed classically so far for this purpose as an addition to a 
message such that the message can neither be disavowed by the signatory nor can it be forged by the 
receiver or a possible attacker [8]. Up to now, conventional (handwritten) and digital approaches have 
been employed in practical applications. While conventional signatures can not be transmitted in the 
electronic network and are vulnerable with respect to forgery, digital signatures have been used widely 
and with considerable success in e-commerce. However, classical cryptography and thus also classical 
signature schemes are in general not unconditionally secure and are in addition difficult to assign to 
messages in qubit format. 

In this paper, we put forward a quantum signature scheme as a method of assigning messages by 
quantum methods to its originator or other users. The algorithm takes advantage of the correlation 
of GHZ states, various qubit operations and a symmetrical quantum key cryptosystem. It is shown to 
be unconditionally secure, i.e. may not be forged or modified in any way by receiver and attacker. In 
addition it may neither be disavowed by the signatory nor may it be deniable by the receiver. 

The article is arranged as follows. In section 2, we investigate at first the general principles we 
demand for a quantum signature scheme which is then proposed and described in detail in section 3. 
The proposed scheme includes an initial phase, a signing phase and a verifying phase. In section 4, the 
unconditional security of the proposed algorithm is derived and the quantum signature is shown neither 
to be disavowable by the signatory nor to be deniable for the receiver. Conclusions are drawn in section 
5. 
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2 General Requirements 



Before presenting the proposed algorithm, we put forward several aspects to be expected to be fulfilled 
for a quantum signature scheme and which have led us to design the quantum signature algorithm to 
follow. Similar to classical digital signatures [8] we demand the following signature rules where only the 
last is characteristic for quantum signature schemes: 

• No modifications and no forgery: Neither the receiver nor a possible attacker are able to change the 
signature or the attached message after completion. The signature may no be reproduced as well. 

• No disavowals: The signatory may not successfully disavow the signature and the signed message. 
It need be possible for the receiver to identify the signatory. The receiver may not successfully deny 
the receipt of message and signature. 

• Firm assignments: Each message is assigned anew to a signature and may not be separated from 
it afterwards. 

• Quantum nature: The signature involves purely quantum mechanical features without a classical 
analog and is therefore by nature non reproducible and may not be disavowed or forged. 

In analogy to conventional and digital signature schemes, a quantum signature algorithm should 
consist also of both a signature and a verification algorithm. These algorithms will also have to be 
prepared by an initial phase, which initializes or prepares the system parameters and creates the keys. 
As usual the signatory, receiver and possible attacker are referred to as Alice, Bob and Oscar, respectively, 
where appropriate. We assume the message to be signed to be carried by a string of qubits \P). The 
signing algorithm is denoted QSk with key K to be used in the signature phase. In the verification 
phase, the resulting signature \S) with IS*) = QSk{\P)) can subsequently be verified using a verification 
algorithm QVk> with key K' . Note the keys K and K' may be the same (symmetrical key cryptosystem) 
as assumed here or be different (public key cryptosystem) [8]. Given a pair (|P),|S)), the verification 
algorithm when applied is required to result "true" or "false" depending on whether the signature is 
authentic or forged. 

A quantum signature scheme may thus be defined as a five-tuple (V,S,)C,Q S ,Q V ) with following 
abbreviations: 

• V is a set of possible quantum messages (qubits). 

• S is a set of possible signatures. It may consist of qubits or classical bits. 

• JC is a set of possible keys. It may be a quantum key or a classical key. 
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• Q s is a set of possible quantum signature algorithms. 

• Q v is a set of possible quantum verification algorithms. 



For each key \K) £ IC, there need be a signature algorithm QSk € Q s and a corresponding verification 
algorithm QVk> € Q v . QSk ■ V — *• <5 and QVr-/ : P x 5 ^ {true, false} are functions such that the 
following equation is satisfied for every message |P) € "P and for every signature \S) e5: 



We emphasize that the signature \S) and the keys may be composed of quantum or classic bits, but we 
require the signature and verification algorithms QSk and QVk< to be of quantum nature. 

We recall that signature schemes are generally divided into two categories, the so called true and the 
arbitrated signature schemes. The true signatures can be produced and verified independently by the 
sender and receiver, respectively. In this category, the signature algorithm is secret but the verification 
algorithm is public. A judge may be called only to settle possible disagreements or disputes. In an arbi- 
trated signature scheme, however, all communications involve a so-called arbitrator, who authenticates 
and validates the signed messages. In this category, both signature algorithm and verification algorithm 
are secret. In the arbitrated signature scheme, the arbitrator is required to be trustworthy, because the 
arbitrator has access to the contents of the messages and the signatures. While a true signature scheme 
is in general favorable, arbitrated digital signature schemes were shown to be applicable and useful, espe- 
cially with reduced requirements on the trustworthiness of the arbitrator [10]. In the following, we develop 
an arbitrated quantum signature scheme based on the requirements and definitions in this section. 

3 Description of the proposed algorithm 

The proposed algorithm includes three phases: the initial phase, the signature phase and the verification 
phase. The scheme involves three partners, the signatory Alice, the receiver Bob and the arbitrator. In 
the initial phase, the three communicators entangle themselves via GHZ states and distribute their secret 
keys. In the signature phase, Alice prepares and signs her message and obtains an entangled quantum set 
of message and signature. In the verification phase, Bob verifies Alice's signature with the arbitrator's 
help. 

3.1 Initial phase 

This phase generates the keys, sets up the system and distributes the GHZ particles required for our 
signature scheme. 




(1) 
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Step 1. Generation and distribution of keys: Alice and Bob begin by obtaining their secret keys 
K a ,Kb, where K a ,Kb are employed in the communications between Alice and arbitrator and between 
Bob and arbitrator, respectively. These keys may be obtained by using standard technologies of quantum 
and classic cryptography. Our keys here are assumed to be generated via quantum cryptographic methods 
(see e.g. BB84 or EPR protocols in [3]) because of their unconditional security. 

Step 2. Generation and distribution of GHZ triplet states: Our algorithm relies crucially on the 
entanglement of the three involved communicators Alice, Bob and arbitrator. This shall be established 
here prior each communication by a distribution of one particle of GHZ triplet states to each of the three. 
For convenience, we assume the arbitrator to create and distribute the GHZ particles in our consideration. 
When the arbitrator receives Alice's or Bob's application for an arbitrated communication, he is required 
to create a string of GHZ triplet states and then to distribute two particles of each GHZ triplet state to 
each Alice and Bob and to keep the remaining one for himself for each GHZ state. As a consequence, 
arbitrator, Alice and Bob are entangled because they hold one particle of each GHZ triplet state. The 
GHZ states for a three particle system involve eight orthonormal triplet states, while in this article, for 
convenience, we restrict ourselves to the state 

|^ = ^(|000) + |111)). (2) 

We emphasize for above procedures, that step 1 is finished once the system has been set up, and that 
it is not necessary to repeat it in later communications. Step 2 is necessary to be redone for every single 
communication, the necessity of which becomes clear in the description of the algorithm. 

As a practical consideration we add at this stage that GHZ triplet states have been widely studied in 
quantum information science [5,11] and in particular have been successfully implemented experimentally 
[12,13]. With respect to our demands on the GHZ states in step 2, a practical realization may follow the 
procedure presented in [14]. Along those lines the arbitrator may generate a short weak light pulse and 
then employ an interferometer to split this pulse into two pulses of smaller, equal amplitude, following 
each other with fixed phase relation. The light is then focused into a nonlinear crystal where some of 
the pump photons are down-converted into correlated photon pairs. While the first part of the set-up 
is located with the arbitrator, the two down-converted weak photon beams are separated and sent one 
each to Alice and Bob. This approach has been successful for the experimental verification of quantum 
key sharing [15], such that it should be feasible in principle also for our proposed algorithm. 

3.2 Signing phase 

This phase corresponds to the actual signature algorithm QSk, i-e. to sign the message \P) with a 
suitable signature | S) . Following steps are required: 
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Step 1. Alice creates a string of qubits \P) (information qubits) which carry the message to be signed. 
We assume n qubits in the string, such that \P) reads 

\P) = {\ Pl ),\ P2 ),---,\ Pn )}. (3) 

where the symbol {• • •} denotes a set in this article and \pi) a single qubit in the string \P). Any qubit 
\pi)(i = 1, 2, • • • ,n) in \P) can be expressed as a superposition of the two eigenstates |0), |1), i.e., 

\ Pi ) = ai \0) + (4) 

where at, Pi are complex numbers with \cti\ 2 + \/3i\ 2 = 1. Using the above equation Eq. (||) Alice's 
information string of qubits can be represented as 

\P) = {a 1 |0)+/3 1 |l),a 2 |0)+/3 2 |l),---,a„|0)+/3„|l)}. (5) 

Step 2. The aim for Alice in this step is to create a secret string of qubits \R) which involves 
random features but also depends clearly on the information string \P). As a first step Alice relates 
the key K a — {\K^), \K 2 ), ■ • • , \K™)} to a sequence of measurement operators M.K a , often referred to as 
measurement basis which we denote 

M Ka = {M x Kl M\i,---M\^- (6) 

The operators M l Ri are defined to arise from the key |Jf*) for i 6 {1, 2, • • • ,n} via M l Ki \K l a ) — \i\K l a ). 
There is thus a degree of arbitrariness in the definition of those operators with Ai being the corresponding 
eigenvalues. As a simple example, this may, e.g., be carried out for a key K a consisting of nonorthogonal 
states | a) and \b) (see e.g. the B92 protocol in [4]) by choosing two appropriate operators O a and Ob, 
where O a \a) — \\\a) and Of,|6) = A2 j 6) - This way, Alice may obtain a string of measurement bases M.K a 
consisting of O a and O b by transferring = |o) to = O a and \K 3 a ) = \b) to M l RZ = O b for 

€ {1, 2, • • • , n}. Alternatively Alice may use the measurement basis of polarized photons, e.g. as in 
the BB84 protocol and let the bit "1" (or qubit \j) and 1^)) correspond to the diagonal measurement 
basis and "0" (or qubit |0) and 1^)) correspond to the rectilinear measurement basis, or vice versa [6]. 

After the transformation, Alice is required to measure the information string of qubits \P) using Mx a 
and obtains 

\R)=M Ka \P) = {\n),\r2),---,\r n )}, (7) 

where |r^} = M. l Ki \pi) and denotes the \ th qubit in the string of \R). Note the string \R) is secret, is 
associated with Alice's message and involves both quantum mechanics and Alice's actions. It will form 
an essential part of the full signature scheme. 
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Step 3. Alice entangles each qubit of the information string \P) with one particle each of her equally 
long GHZ particle string to become a particle-pair. This may be implemented by applying a joint 
measurement on both particles, such as in a quantum logic gate operation [15]. Each combination 
generates a four-particle entangled state, involving the three GHZ particles and the information qubit. 
Using Eqs. (2) and (4) the four-particle entangled state can be described as follows 

\4>)i= \ik)®\iI>) 

= U\^12)a(ai\00) Ab + Pi\ll) Ab ) 

+|*r 2 >«(ai|00U-&|llU) ( 8 ) 

Ab) 

+ \®u)a(fc\00) Ab - a t \ll) Ab )}, 

where the subscripts a, A, b correspond, respectively, to Alice, the arbitrator and Bob. |*i" 2 ), l*^); ^12)' ^12) 
denote the four Bell states [16]. 

Step 4. Alice carries out n Bell measurements, i.e. for each i £ {1, • • • , n} the state \<j>)i in Eq. (8) is 
projected to one of its four summands written on top of each other. The effect of this measurement is to 
disentangle Alice's two particles (information qubit and GHZ particle) to be in one of the four Bell states 
and to retain the arbitrator's and Bob's corresponding GHZ particles to be in a two-particle entanglement 
state as visible in Eq. (8). Thus, Alice obtains the following set M a of quantum states 

M a = {Ml,M 2 a ,---,M n a }, (9) 

where M\ may be any of the four Bell states in { 1^x2) ^ 1*12)5 1^12)1 1^^)}* m particular is the result 
arising from her Bell measurement on state in Eq. (8). 

Step 5. Alice obtains the quantum signature \S) for the information qubit string \P) by encrypting 
M a and the secret qubit string \R) by the secret key K a , i.e. 

\S) = K a (M a ,\R)). (10) 

M a , even though consisting of quantum mechanical Bell states, may be presented by classical bits, 
and thus be encrypted by a classical one-time pad. \R) could be encrypted by the approach known as 
"quantum state operation" . Another way would be to transfer M a into a string of qubits \M a ) and then 
make measurements on both \M a ) and \R) via MK a - 

Step 6. Alice sends the string of information qubits \P) followed by the signature \S) to Bob. 

We emphasize again that the signature is associated with \P) because \R) was generated via the string 
of information qubits. We note also at this state already that Alice's secret key was crucial in preparing 
the signature such that it appears difficult at least for Alice to disavow it in the face of the arbitrator or 
for Bob and attacker to forge it. In addition we realize that the separation of message and signature by 
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Oscar would not benefit him or anybody else because the message is valid only with the correct signature 
and new messages will be assigned new signatures. The arbitrator has been hardly involved up to this 
stage but this will change in the verification phase to be discussed in the following. 



3.3 Verification phase 

A verification algorithm QVk is developed here such that Bob is enabled to verify Alice's signature \S) 
and consequently judge the authenticity of the information qubits \P). The verification process in this 
scheme requires the help of the arbitrator because Bob does not possess Alice's key which is necessary 
for the verification of the signature. The verification phase is executed by the following procedure: 

Step 1. Bob measures his string of GHZ particles which, at this stage, are only entangled to the 
particles of the arbitrator. The measurement is performed such that the two possible outcomes are either 
\+x) or | — x) with \+x) = ^(|0) + |1)) and | — x) = ^(|0) — |1)) (referred to as measurements in the 
x direction). The sequence of the results of the measurement Mb can thus be expressed as 



where M\ is any of two states in {| + x), \ — x)}. Encrypting Mb,\S) and |P) with the aid of Bob's key 
Kb, he obtains 



Then, Bob sends yb to the arbitrator. 

Step 2. The arbitrator becomes active now and generates a verification parameter 7 based on the 
communication from Bob, which contains information also from Alice. After receiving yb, the arbitrator 
decrypts it using Kb, and obtains \S), \P), Mb- Then the arbitrator decrypts \S) using the key K a , which 
he has since step 1 of the initial phase. This gives rise to \R'), which need be compared with \R). With 
\R'), \P) and Mx a , the arbitrator then creates a parameter 7 via 



Step 3. The arbitrator measures or evaluates the states of the particles in his string of GHZ particles. 
In previous steps, the arbitrator has obtained already Alice's and Bob's measurement results, M a , Mb, so 
that he can easily determine his states using Eq. (8). Equally the arbitrator may choose an appropriate 
sequence of measurement operators to measure his string of GHZ particles, and obtains either way 
Mt = {Ml, M\, ■ ■ ■ , M™}. Note that M\ may be | + x) or | — x) with the same definitions as in section 
f for Bob. Encrypting M a ,Mb,Mt, \S) and 7 via the key Kb, the arbitrator obtains 



Mb = {M\,Ml,---,M b 1 }, 



(11) 



y b = K b {Mb,\S),\P)). 



(12) 




*/ \R') = \R)=M Ka \P) 
if \R')^\R)=M Ka \P) 



(13) 



ytb = K b {Ma,Mb,M t ,i, \S)). 



(14) 
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Following completion of this procedure, the arbitrator sends ytb to Bob. 

Step 4. Bob decrypts ytb and obtains Ai a , Mb, Ait, \S) and 7. These parameters will turn out essential 
for Bob for the verification of Alice's signature. This will occur in the two steps to follow, where the first 
is to eliminate obvious forgeries quickly while the second is more demanding but allows for full security. 

Step 5. Bob undertakes the first verification for Alice's signature \S) via the parameter 7. If 7 = 0, 
the signature has obviously been forged and Bob may reject the message \P) immediately. If 7 = 1, Bob 
goes on for further verification to the next step. 

Step 6. The relation 7=1 merely shows that the secret string of qubits \R) is correct. However, 
this does not fully confirm that the signature \S) is correct because the attacker may have forged the 
signature by other means (see Eq. (10)). Thus Bob need a further verification. This will have to be 
obtained via the initial correlation of the GHZ triplet states. Taking advantage of Ai a and Ait and a 
further transformation to be detailed later in Eq. (17), Bob evaluates the information string of qubits 
\P'). This Bob has to compare with the original information string of qubits \P). If \P') = \P), the 
signature is completely correct and Bob accepts \P), otherwise, he should reject it. We emphasize that the 
result \P') is obtained from a calculation and not a direct physical measurement, because Bob's particle 
has already been measured in step 1 of the verification phase. However, since Ait depends on Aib, the 
result of the calculation \P') is equally influenced by Bob's measurement. This is useful regarding high 
security because it prevents eavesdropping via intercepting Bob's GHZ particle as analyzed in [5]. 

We note that Ai a and Ait are essential for Bob to obtain \P') as obvious from Eq. (8). If, e.g., Alice's 
result is \^i 2 ) or \^i2li Bob's density matrix of the GHZ particle reads 

Pb = K| 2 |0) bb (0| + |/3 4 | 2 |l) bb (l|, (15) 

while in the remaining two cases \$f 2 ) an d 1*^)) Bob's density matrix of the GHZ particle is 

p b = |A| 2 |0) b „(0| + M 2 |l) bb (l|. (16) 

Thus even with Alice's results {A4*}, Bob can only obtain partly information of the qubit \pi) without 
the knowledge of Ait- In order to obtain \pi), Bob needs thus A4 a , A^t and in addition simultaneously 
the following transformations [5] , 

|tff 2 )„| +x) A 

\^tl)a\-x) A 
\^ 2 )a\+x) A 
l*r 2 >a|-a;>A 

where Oi,i — x,y, z are the Pauli matrices and I is the identity matrix. How this above transformation 
need be employed will be explained in the next paragraph with the help of an example. 



°z, |*12)o| - X)A -» <T X (T Z , 
<?z, \®12)a\ +x) A -> °xVz, 
\®12)a\ ~X) A -> <7 X , 



(17) 
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We assume for example that Alice's result is 1*12)5 so that following Eq. (8) the arbitrator's and 
Bob's entanglement state must be 

\<p) Ab = a i \00}+f3 i \ll). (18) 

It can be rewritten as 

/2 /2 
W) Ab = \\+x) A {di\Q) b + 0i\l) b ) + \\- x) A («i|0) 6 ~ A|l)b) • (19) 

Obviously, when the arbitrator's result is | + a;), above equation shows that Bob's calculated result is 
aij|0) which just equals \pi). This means that under the transformation I Bob can calculate the 

result \pi). When, however, the arbitrator's result is |— x), Bob's calculated result is a,|0) — In this 

case we do not get the original information qubit in spite of the absence of forgery. Thus a transformation 
is necessary which is the reason of Eq. (17). According to Eq. (17) for the arbitrator's result | — x), Bob 
makes the transformation a z on the state «i|0) — /3j|l). Finally Bob obtains the state of \pi) which is 
the same as the corresponding state in the original string \P). This is the proof that the signature was 
authentic, while if Bob's results after the transformation Eq. (17) had been different to the corresponding 
state in the original string \P), there must have been some sort of fraud. This procedure via Eq. (17) 
has to be carried out for each state in the information string |P). Alice's signature is only successfully 
verified if all n elements are rederived by Bob in the procedure described above in step 6. 

We summarize this subsection and emphasize that the verification phase needs the assistance of an 
arbitrator. This becomes clear from steps 2 and 3, however the verification itself is completed mainly 
by Bob. This reduces the dependence on the arbitrator somewhat. It also saves the resources of the 
network system because the complete execution of the verification by the arbitrator is likely to become 
a considerable burden on the network system. The parameter 7 should be useful for a reasonably large 
efficiency of the verification procedure. When 7 = 0, the received string \R') differs from the original 
secret string of qubits \R), so that the signature is obviously to be rejected instantaneously. In this case 
Bob does not need to make further verifications, so that further efforts are avoided. When 7 = 1, the 
authenticity however is not confirmed yet because the attacker may have forged the signature \S) by 
other means. In the practical situation, for example, in which the K a has been discovered without Alice's 
awareness, the parameter 7 will not be of any help to discover this happening. In this case Oscar may 
forge \R) but without M a may not find |5*). In step 6, with the help of the correlation of the GHZ triplet 
states, Bob would then discover any fraud. 

4 Security Analysis and Discussion 

The security analysis of the quantum signature scheme is different from what we are used to for quantum 
key distributions. In the signature scheme, complete security requires, that the signatory can not disavow 
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the signature, and that the receiver and the attackers have no possibility to obtain the signature or the 
signature keys so that they may forge the signature. In the following we will demonstrate that our 
proposed algorithm is unconditionally secure. 

4.1 Impossibility of Forgery 

A dishonest Bob or an attacker may seek to forge Alice's signature, to his own benefit. In the two 
paragraphs to follow we show that neither Bob nor any attacker may forge the signature or the message. 

We begin by assuming that Bob is dishonest and tries to forge Alice's signature. If successful, this 
is beneficial for him because he can change Alice's signature and design a new signature to a message 
favorable to him. This is impossible, however, because the signature key K a is secretly kept by Alice and 
the arbitrator. As a consequence, Bob can not obtain the correct state \R), which is necessary for the 
generation of the signature (please see Eq.(lO)). Subsequently the parameter 7 is not correct, so that 
this forgery can be noted when the arbitrator is called to settle a dispute between Alice and Bob. 

The attacker is bound to be without success in our algorithm, because the only public parameters 
are \P),\S),yb, ytb and they do not offer any information of the secret keys K a and K b . Especially, when 
the communicators encrypt the messages by a one-time pad algorithm which is relatively easy to be 
implemented in quantum cryptography, the security is very high. Even if the attacker do somehow get 
hold of Alice's and Bob's keys, a forgery remains still impossible. This is because the attacker has no 
access to Alice's measurement results Ai a , which are secret and are involved in generating the quantum 
signature \S) (see again Eq. (10)). The verification condition \P') = \P) can not be satisfied without the 
correct M a . Thus, the correlation of the GHZ triplet state avoids forgery by an attacker. 

4.2 Impossibility of Disavowal for the Signatory 

If Alice disavows her signature, it is very easy to discover it, because Alice's key is contained in the 
signature \S). Thus, if Alice and Bob are engaged in a dispute because of Alice's disavowal, they just 
need to send the signature \S) to the arbitrator. If the signature \S) contains Alice's key K a , this signature 
has been carried out by Alice, otherwise, the signature has been forged by Bob or the attacker. Therefore, 
the arbitrator is in the position to judge whether Alice has disavowed her signature. 

4.3 Impossibility of Denial for the Receiver 

A conventional and a digital signature scheme is termed undeniable if Bob can not deny his receiving 
of Alice's files. This feature is not generally demanded of a signature but it may be useful for many 
practical applications. Our algorithm contains this property, i.e. Bob can not disavow his receiving of 
the signature \S) and the information qubit string \P). This is essentially impossible because he needs 
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the assistance of the arbitrator in the verification process. In addition we can reduce the dependence 
on the arbitrator by small modifications without losing this property of having an undeniable signature 
scheme. In the verification procedure, Bob obtains y b in step 1 and sends it to Alice rather than to the 
arbitrator as in the original version. Then Alice obtains the new signature \S) — K a (M a , \R),yf,) and 
sends it to the arbitrator. The arbitrator then modifies y ta in step 3 of the verification phase to be 

y tb = K h {M a ,Mb,Mul,\S)). (20) 

After this change Alice's and Bob's key are included in the signature \S). Then Bob can not disavow the 
fact that the received files have come from Alice, i.e., Bob's receipt of the files is undeniable. 

5 Conclusions 

The general principle and all detailed procedures of a quantum signature scheme have been described and 
explained. The similarities to the digital signature scheme were pointed out but emphasis was placed on 
the description of the quantum methods in the algorithms such as the use of GHZ states. Our quantum 
signature scheme includes three phases: the initial phase, the signature phase and the verification phase. 
In the initial phase, all keys are prepared and distributed and in particular an entanglement is established 
among the communicators including the arbitrator. In the signature phase, the quantum signature is 
generated in association with the message and as a function of various quantum operations, keys, GHZ 
states and Bell measurements. The receiver verifies the authenticity of the quantum signature in the 
verification phase. Similar to classical arbitrated signature schemes, the verification of the quantum 
arbitrated signature scheme also needs the help of the arbitrator. The proposed algorithm should be 
practical in small networks (e.g. local rather than wide-spread network systems). The security analysis 
showed that the proposed scheme is unconditionally secure and may neither be disavowed by the signatory 
nor may it be deniable by the receiver. 
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